using System.Data;
using System.Globalization;
using Microsoft.Data.Sqlite;
using ZB.MOM.WW.Secrets.Abstractions;

namespace ZB.MOM.WW.Secrets.Sqlite;

/// <summary>
/// SQLite-backed <see cref="ISecretStore"/>. Persists the envelope-encrypted
/// <see cref="StoredSecret"/> rows and their safe <see cref="SecretMetadata"/> projection,
/// using parameterized commands throughout. Local writes go through
/// <see cref="UpsertAsync"/> (which bumps the revision); replicated rows go through
/// <see cref="ApplyReplicatedAsync"/> (last-writer-wins, applied verbatim).
/// </summary>
/// <remarks>Timestamps are stored as round-trippable ISO-8601 (<c>"O"</c>) TEXT;
/// <c>content_type</c> as the enum name; <c>is_deleted</c> as a 0/1 integer.</remarks>
public sealed class SqliteSecretStore(SecretsSqliteConnectionFactory connectionFactory) : ISecretStore
{
    // All columns of the secret table, in schema order, for full-row reads.
    private const string AllColumns =
        "name, description, content_type, ciphertext, nonce, tag, wrapped_dek, wrap_nonce, wrap_tag, " +
        "kek_id, revision, is_deleted, deleted_utc, created_utc, updated_utc, created_by, updated_by";

    // The safe metadata projection — deliberately excludes every ciphertext / crypto BLOB column.
    private const string MetadataColumns =
        "name, description, content_type, kek_id, revision, is_deleted, created_utc, updated_utc, created_by, updated_by";

    /// <inheritdoc />
    public async Task<StoredSecret?> GetAsync(SecretName name, CancellationToken ct)
    {
        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText = $"SELECT {AllColumns} FROM secret WHERE name = $name;";
        command.Parameters.AddWithValue("$name", name.Value);

        await using SqliteDataReader reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);

        if (!await reader.ReadAsync(ct).ConfigureAwait(false))
        {
            return null;
        }

        return ReadStoredSecret(reader);
    }

    /// <inheritdoc />
    public async Task UpsertAsync(StoredSecret row, CancellationToken ct)
    {
        ArgumentNullException.ThrowIfNull(row);

        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        string now = DateTimeOffset.UtcNow.ToString("O");

        // INSERT establishes revision 0 / created==updated==now; ON CONFLICT overwrites the
        // crypto material in place, bumps the revision, refreshes updated_utc/updated_by, and
        // clears any tombstone — but deliberately preserves created_utc / created_by.
        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText = """
            INSERT INTO secret (
                name, description, content_type, ciphertext, nonce, tag,
                wrapped_dek, wrap_nonce, wrap_tag, kek_id, revision,
                is_deleted, deleted_utc, created_utc, updated_utc, created_by, updated_by)
            VALUES (
                $name, $description, $content_type, $ciphertext, $nonce, $tag,
                $wrapped_dek, $wrap_nonce, $wrap_tag, $kek_id, 0,
                0, NULL, $now, $now, $created_by, $updated_by)
            ON CONFLICT(name) DO UPDATE SET
                description  = excluded.description,
                content_type = excluded.content_type,
                ciphertext   = excluded.ciphertext,
                nonce        = excluded.nonce,
                tag          = excluded.tag,
                wrapped_dek  = excluded.wrapped_dek,
                wrap_nonce   = excluded.wrap_nonce,
                wrap_tag     = excluded.wrap_tag,
                kek_id       = excluded.kek_id,
                revision     = secret.revision + 1,
                updated_utc  = $now,
                updated_by   = excluded.updated_by,
                is_deleted   = 0,
                deleted_utc  = NULL;
            """;
        BindCryptoColumns(command, row);
        command.Parameters.AddWithValue("$now", now);
        command.Parameters.AddWithValue("$created_by", (object?)row.CreatedBy ?? DBNull.Value);
        command.Parameters.AddWithValue("$updated_by", (object?)row.UpdatedBy ?? DBNull.Value);

        await command.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
    }

    /// <inheritdoc />
    public async Task<bool> DeleteAsync(SecretName name, string? actor, CancellationToken ct)
    {
        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        string now = DateTimeOffset.UtcNow.ToString("O");

        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText = """
            UPDATE secret SET
                is_deleted  = 1,
                deleted_utc = $now,
                revision    = revision + 1,
                updated_utc = $now,
                updated_by  = $actor
            WHERE name = $name AND is_deleted = 0;
            """;
        command.Parameters.AddWithValue("$now", now);
        command.Parameters.AddWithValue("$actor", (object?)actor ?? DBNull.Value);
        command.Parameters.AddWithValue("$name", name.Value);

        int rowsAffected = await command.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
        return rowsAffected > 0;
    }

    /// <inheritdoc />
    public async Task<IReadOnlyList<SecretMetadata>> ListAsync(bool includeDeleted, CancellationToken ct)
    {
        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText =
            $"SELECT {MetadataColumns} FROM secret WHERE ($include_deleted OR is_deleted = 0) ORDER BY name;";
        command.Parameters.AddWithValue("$include_deleted", includeDeleted ? 1 : 0);

        var results = new List<SecretMetadata>();
        await using SqliteDataReader reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
        while (await reader.ReadAsync(ct).ConfigureAwait(false))
        {
            results.Add(new SecretMetadata
            {
                Name = new SecretName(reader.GetString(0)),
                Description = reader.IsDBNull(1) ? null : reader.GetString(1),
                ContentType = Enum.Parse<SecretContentType>(reader.GetString(2)),
                KekId = reader.GetString(3),
                Revision = reader.GetInt64(4),
                IsDeleted = reader.GetInt64(5) != 0,
                CreatedUtc = ParseUtc(reader.GetString(6)),
                UpdatedUtc = ParseUtc(reader.GetString(7)),
                CreatedBy = reader.IsDBNull(8) ? null : reader.GetString(8),
                UpdatedBy = reader.IsDBNull(9) ? null : reader.GetString(9),
            });
        }

        return results;
    }

    /// <inheritdoc />
    public async Task<IReadOnlyList<SecretManifestEntry>> GetManifestAsync(CancellationToken ct)
    {
        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText = "SELECT name, revision, updated_utc, is_deleted FROM secret ORDER BY name;";

        var results = new List<SecretManifestEntry>();
        await using SqliteDataReader reader = await command.ExecuteReaderAsync(ct).ConfigureAwait(false);
        while (await reader.ReadAsync(ct).ConfigureAwait(false))
        {
            results.Add(new SecretManifestEntry
            {
                Name = new SecretName(reader.GetString(0)),
                Revision = reader.GetInt64(1),
                UpdatedUtc = ParseUtc(reader.GetString(2)),
                IsDeleted = reader.GetInt64(3) != 0,
            });
        }

        return results;
    }

    /// <inheritdoc />
    public async Task ApplyReplicatedAsync(StoredSecret row, CancellationToken ct)
    {
        ArgumentNullException.ThrowIfNull(row);

        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        await using SqliteTransaction transaction = (SqliteTransaction)
            await connection.BeginTransactionAsync(IsolationLevel.Serializable, ct).ConfigureAwait(false);

        // Read the local (updated_utc, revision) so we can apply last-writer-wins.
        await using (SqliteCommand read = connection.CreateCommand())
        {
            read.Transaction = transaction;
            read.CommandText = "SELECT updated_utc, revision FROM secret WHERE name = $name;";
            read.Parameters.AddWithValue("$name", row.Name.Value);

            await using SqliteDataReader reader = await read.ExecuteReaderAsync(ct).ConfigureAwait(false);
            if (await reader.ReadAsync(ct).ConfigureAwait(false))
            {
                DateTimeOffset localUpdated = ParseUtc(reader.GetString(0));
                long localRevision = reader.GetInt64(1);

                // Incoming wins only if strictly newer by (updated_utc, then revision). Routed through
                // the shared predicate so every store agrees on ties — see SecretLastWriterWins.
                if (!SecretLastWriterWins.IsNewer(row.UpdatedUtc, row.Revision, localUpdated, localRevision))
                {
                    await transaction.CommitAsync(ct).ConfigureAwait(false);
                    return;
                }
            }
        }

        // Apply the incoming row VERBATIM — its own revision, timestamps, tombstone flag, and
        // crypto material — with no revision bump (this is the replication path, not a local write).
        await using (SqliteCommand upsert = connection.CreateCommand())
        {
            upsert.Transaction = transaction;
            upsert.CommandText = """
                INSERT INTO secret (
                    name, description, content_type, ciphertext, nonce, tag,
                    wrapped_dek, wrap_nonce, wrap_tag, kek_id, revision,
                    is_deleted, deleted_utc, created_utc, updated_utc, created_by, updated_by)
                VALUES (
                    $name, $description, $content_type, $ciphertext, $nonce, $tag,
                    $wrapped_dek, $wrap_nonce, $wrap_tag, $kek_id, $revision,
                    $is_deleted, $deleted_utc, $created_utc, $updated_utc, $created_by, $updated_by)
                ON CONFLICT(name) DO UPDATE SET
                    description  = excluded.description,
                    content_type = excluded.content_type,
                    ciphertext   = excluded.ciphertext,
                    nonce        = excluded.nonce,
                    tag          = excluded.tag,
                    wrapped_dek  = excluded.wrapped_dek,
                    wrap_nonce   = excluded.wrap_nonce,
                    wrap_tag     = excluded.wrap_tag,
                    kek_id       = excluded.kek_id,
                    revision     = excluded.revision,
                    is_deleted   = excluded.is_deleted,
                    deleted_utc  = excluded.deleted_utc,
                    created_utc  = excluded.created_utc,
                    updated_utc  = excluded.updated_utc,
                    created_by   = excluded.created_by,
                    updated_by   = excluded.updated_by;
                """;
            BindCryptoColumns(upsert, row);
            upsert.Parameters.AddWithValue("$revision", row.Revision);
            upsert.Parameters.AddWithValue("$is_deleted", row.IsDeleted ? 1 : 0);
            upsert.Parameters.AddWithValue("$deleted_utc", (object?)row.DeletedUtc?.ToString("O") ?? DBNull.Value);
            upsert.Parameters.AddWithValue("$created_utc", row.CreatedUtc.ToString("O"));
            upsert.Parameters.AddWithValue("$updated_utc", row.UpdatedUtc.ToString("O"));
            upsert.Parameters.AddWithValue("$created_by", (object?)row.CreatedBy ?? DBNull.Value);
            upsert.Parameters.AddWithValue("$updated_by", (object?)row.UpdatedBy ?? DBNull.Value);

            await upsert.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
        }

        await transaction.CommitAsync(ct).ConfigureAwait(false);
    }

    /// <inheritdoc />
    public async Task<bool> ApplyRewrapAsync(
        StoredSecret rewrappedRow, byte[] expectedCurrentWrappedDek, CancellationToken ct)
    {
        ArgumentNullException.ThrowIfNull(rewrappedRow);
        ArgumentNullException.ThrowIfNull(expectedCurrentWrappedDek);

        await using SqliteConnection connection =
            await connectionFactory.OpenConnectionAsync(ct).ConfigureAwait(false);

        // Overwrite ONLY the KEK-wrap envelope + kek_id. Revision, updated_utc/by, the sealed body,
        // and the tombstone state are deliberately untouched — a re-wrap is not a logical change, so
        // it must not bump the revision or updated timestamp (see ISecretStore.ApplyRewrapAsync).
        //
        // Compare-and-swap on wrapped_dek: a concurrent set/rotate generates a fresh (random) DEK
        // wrap, so this matches 0 rows instead of pairing this stale re-wrap with a newer body —
        // which would leave the row permanently undecryptable. The caller re-processes a 0-row miss.
        await using SqliteCommand command = connection.CreateCommand();
        command.CommandText = """
            UPDATE secret SET
                wrapped_dek = $wrapped_dek,
                wrap_nonce  = $wrap_nonce,
                wrap_tag    = $wrap_tag,
                kek_id      = $kek_id
            WHERE name = $name AND wrapped_dek = $expected_wrapped_dek;
            """;
        command.Parameters.AddWithValue("$wrapped_dek", rewrappedRow.WrappedDek);
        command.Parameters.AddWithValue("$wrap_nonce", rewrappedRow.WrapNonce);
        command.Parameters.AddWithValue("$wrap_tag", rewrappedRow.WrapTag);
        command.Parameters.AddWithValue("$kek_id", rewrappedRow.KekId);
        command.Parameters.AddWithValue("$name", rewrappedRow.Name.Value);
        command.Parameters.AddWithValue("$expected_wrapped_dek", expectedCurrentWrappedDek);

        int rowsAffected = await command.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
        return rowsAffected > 0;
    }

    // Binds the identity, description, content-type, KEK id, and all six crypto BLOB columns
    // shared by every insert path.
    private static void BindCryptoColumns(SqliteCommand command, StoredSecret row)
    {
        command.Parameters.AddWithValue("$name", row.Name.Value);
        command.Parameters.AddWithValue("$description", (object?)row.Description ?? DBNull.Value);
        command.Parameters.AddWithValue("$content_type", row.ContentType.ToString());
        command.Parameters.AddWithValue("$ciphertext", row.Ciphertext);
        command.Parameters.AddWithValue("$nonce", row.Nonce);
        command.Parameters.AddWithValue("$tag", row.Tag);
        command.Parameters.AddWithValue("$wrapped_dek", row.WrappedDek);
        command.Parameters.AddWithValue("$wrap_nonce", row.WrapNonce);
        command.Parameters.AddWithValue("$wrap_tag", row.WrapTag);
        command.Parameters.AddWithValue("$kek_id", row.KekId);
    }

    private static StoredSecret ReadStoredSecret(SqliteDataReader reader) => new()
    {
        Name = new SecretName(reader.GetString(0)),
        Description = reader.IsDBNull(1) ? null : reader.GetString(1),
        ContentType = Enum.Parse<SecretContentType>(reader.GetString(2)),
        Ciphertext = reader.GetFieldValue<byte[]>(3),
        Nonce = reader.GetFieldValue<byte[]>(4),
        Tag = reader.GetFieldValue<byte[]>(5),
        WrappedDek = reader.GetFieldValue<byte[]>(6),
        WrapNonce = reader.GetFieldValue<byte[]>(7),
        WrapTag = reader.GetFieldValue<byte[]>(8),
        KekId = reader.GetString(9),
        Revision = reader.GetInt64(10),
        IsDeleted = reader.GetInt64(11) != 0,
        DeletedUtc = reader.IsDBNull(12) ? null : ParseUtc(reader.GetString(12)),
        CreatedUtc = ParseUtc(reader.GetString(13)),
        UpdatedUtc = ParseUtc(reader.GetString(14)),
        CreatedBy = reader.IsDBNull(15) ? null : reader.GetString(15),
        UpdatedBy = reader.IsDBNull(16) ? null : reader.GetString(16),
    };

    private static DateTimeOffset ParseUtc(string value) =>
        DateTimeOffset.Parse(value, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind);
}
